PT-2012-6009

CVE-2012-5538

·

Publicado

2012-12-03

·

Atualizado

2012-12-04

Descrição por

CVSS 2.0
2.1
Baixa
MétricasAV:N/AC:H/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Drupal FileField Sources module versions 6.x-1.x before 6.x-1.6 Drupal FileField Sources module versions 7.x-1.x before 7.x-1.6
Description A cross-site scripting (XSS) issue exists in the FileField Sources module for Drupal. This occurs when the field has "Reference existing" source enabled, allowing remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
Recommendations For Drupal FileField Sources module version 6.x-1.x, update to version 6.x-1.6 or later. For Drupal FileField Sources module version 7.x-1.x, update to version 7.x-1.6 or later.
Explorabilidade
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Identificadores relacionados
CVE-2012-5538
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com